{"id":"CVE-2026-90029","state":"PUBLISHED","title":"usb: storage: realtek_cr: fix use-after-free on disconnect","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: realtek_cr: fix use-after-free on disconnect\n\nrealtek_cr_destructor() calls timer_delete() before the chip containing\nthe timer is freed. The timer callback may still be running and can\nrearm itself, resulting in a use-after-free.\n\nUse timer_shutdown_sync() to wait for the callback and prevent further\nrearming. Do this unconditionally because ss_en may be changed after\nthe timer is armed.\n\nMove timer_setup() into init_realtek_cr() so the timer is initialized\nbefore any failure path can invoke the destructor.\n\nFound by static analysis.","publishedAt":"2026-09-16T10:33:31.117Z","updatedAt":"2026-10-30T12:33:52.606Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"f98c2f119fcd81cfede114d2fd3463a17aed8209","versionType":"git"},{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"0935e57ede003bbe35de9c5d6a49260999ca0314","versionType":"git"},{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"c1e7e35100efffba7c9e1dfa76519d6cd323ba3d","versionType":"git"},{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"524d4257f741cd95eb85e2817c9c890928fcfef7","versionType":"git"},{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"7c4e2f964c65dea4ea22386799d5fb10ef1e3e54","versionType":"git"},{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"cae9dbba6adae21a04a3bd045e07b489847ff2c6","versionType":"git"},{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/storage/realtek_cr.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.1","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.51","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.5","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/storage/realtek_cr.c"]}],"references":["https://git.kernel.org/stable/c/f98c2f119fcd81cfede114d2fd3463a17aed8209","https://git.kernel.org/stable/c/0935e57ede003bbe35de9c5d6a49260999ca0314","https://git.kernel.org/stable/c/c1e7e35100efffba7c9e1dfa76519d6cd323ba3d","https://git.kernel.org/stable/c/524d4257f741cd95eb85e2817c9c890928fcfef7","https://git.kernel.org/stable/c/7c4e2f964c65dea4ea22386799d5fb10ef1e3e54","https://git.kernel.org/stable/c/cae9dbba6adae21a04a3bd045e07b489847ff2c6","https://git.kernel.org/stable/c/4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc"],"weaknesses":[],"ingestedAt":"2026-10-30T12:52:04.348Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90029.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90029","state":"PUBLISHED","datePublished":"2026-09-16T10:33:31.117Z","dateUpdated":"2026-10-30T12:33:52.606Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.782Z"},"containers":{"cna":{"title":"usb: storage: realtek_cr: fix use-after-free on disconnect","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: realtek_cr: fix use-after-free on disconnect\n\nrealtek_cr_destructor() calls timer_delete() before the chip containing\nthe timer is freed. The timer callback may still be running and can\nrearm itself, resulting in a use-after-free.\n\nUse timer_shutdown_sync() to wait for the callback and prevent further\nrearming. Do this unconditionally because ss_en may be changed after\nthe timer is armed.\n\nMove timer_setup() into init_realtek_cr() so the timer is initialized\nbefore any failure path can invoke the destructor.\n\nFound by static analysis."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"f98c2f119fcd81cfede114d2fd3463a17aed8209","versionType":"git"},{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"0935e57ede003bbe35de9c5d6a49260999ca0314","versionType":"git"},{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"c1e7e35100efffba7c9e1dfa76519d6cd323ba3d","versionType":"git"},{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"524d4257f741cd95eb85e2817c9c890928fcfef7","versionType":"git"},{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"7c4e2f964c65dea4ea22386799d5fb10ef1e3e54","versionType":"git"},{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"cae9dbba6adae21a04a3bd045e07b489847ff2c6","versionType":"git"},{"version":"e931830bb877e2aad9a1be83506f9bdb26c91e4e","status":"affected","lessThan":"4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/storage/realtek_cr.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.1","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.51","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.5","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/storage/realtek_cr.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f98c2f119fcd81cfede114d2fd3463a17aed8209"},{"url":"https://git.kernel.org/stable/c/0935e57ede003bbe35de9c5d6a49260999ca0314"},{"url":"https://git.kernel.org/stable/c/c1e7e35100efffba7c9e1dfa76519d6cd323ba3d"},{"url":"https://git.kernel.org/stable/c/524d4257f741cd95eb85e2817c9c890928fcfef7"},{"url":"https://git.kernel.org/stable/c/7c4e2f964c65dea4ea22386799d5fb10ef1e3e54"},{"url":"https://git.kernel.org/stable/c/cae9dbba6adae21a04a3bd045e07b489847ff2c6"},{"url":"https://git.kernel.org/stable/c/4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:33:52.606Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"6.18.51"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"7.2.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}